Overview

overview

7

Static

static

3

84537de028...23.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/08/2026, 15:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    84537de028fc1ceaa44061848dff6febbe79d39cdc00cc645fc993aaa0468a23.exe
  • Size 313KB
  • Sample260824-sr92cawsct
  • SHA256 84537de028fc1ceaa44061848dff6febbe79d39cdc00cc645fc993aaa0468a23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryinstallerspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\84537de028fc1ceaa44061848dff6febbe79d39cdc00cc645fc993aaa0468a23.exe
    "C:\Users\Admin\AppData\Local\Temp\84537de028fc1ceaa44061848dff6febbe79d39cdc00cc645fc993aaa0468a23.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • System policy modification
      PID:2220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        bhoclass.dll
        • Path C:\ProgramData\Codecv\bhoclass.dll
        • Size 137KB
        • SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstall.exe
        • Path C:\ProgramData\Codecv\uninstall.exe
        • Size 46KB
        • SHA256 03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\chrome.manifest
        • Size 114B
        • SHA256 2cf4f0f668adb077ce5b0f7b65b858324f46028b2ea2e407e0d0bc0518de4c91
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        indexeddb.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\indexeddb.js
        • Size 1KB
        • SHA256 e519584b9d63911f225ea0ee70884c9bcd6f7a5b87615def145ae5a81004db4c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\jquery.js
        • Size 91KB
        • SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsext.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\jsext.js
        • Size 6KB
        • SHA256 dc75350d50f2b2daffb6a7f7b51d337765b3a994ae4f97fb43416125dd5894b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lsdb.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\lsdb.js
        • Size 1KB
        • SHA256 ca637baf4ea6e5b393f228f062d9a6cbd97f58d997bbd9a8b4fba2804b32d654
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prfdb.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\prfdb.js
        • Size 1KB
        • SHA256 6cbe7de2acf7e0d624fb00c9145a8ba1b3d39a257380ef53731923e20fd78190
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\sqlite.js
        • Size 1KB
        • SHA256 b5d18a9a031cb26ced690c19487a91f79571a13554db80c9a4e91c67dd2ab7a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wx.xul
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\content\wx.xul
        • Size 228B
        • SHA256 d7f2aaec14a001108b7b14b74a39137b933745140bb30c2e6f539d437c64e434
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.rdf
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\[email protected]\install.rdf
        • Size 676B
        • SHA256 3ac3e9976da0f19d80ecb132208bef03271b3473715b9090925481d0eb1c947c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        background.html
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\background.html
        • Size 5KB
        • SHA256 e54cd5f1bf66c0f8f048edc83b9912aba10c39e15d5df68c5fd33be8e92cf67d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        content.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\content.js
        • Size 735B
        • SHA256 d710ea67751de19bb15bc7cd721f5a4f949d5644e61dd8a01b32e43ee2d6da73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mahhflehnbbdfcgcbfgpcokfnllokicc.crx
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\mahhflehnbbdfcgcbfgpcokfnllokicc.crx
        • Size 37KB
        • SHA256 11bf6896660edb3f63e14ff85adf9b944673fd1e3bfd09398d69727fcbbb99ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\settings.ini
        • Size 604B
        • SHA256 c8bf655d0fd013f5317f4ccf40cb33b1fe1ef01a1f041c6b7e75c837b91c44b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS364D.tmp\setup.exe
        • Size 61KB
        • SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download